TheGeneralist 71e176cbd1 security: fix two Codex review findings + add port option ... Fix 1 — NixOS: store/ dir missing from ReadWritePaths archive_path points to .archivr/; captures write artifacts to the sibling store/ directory. Whitelisting only .archivr/ caused POST /captures to fail under ProtectSystem=strict. Fix: use builtins.dirOf a.path to whitelist the parent, which contains both .archivr/ and store/. Fix 2 — Rust: X-Forwarded-For was unconditionally trusted An attacker could send a different IP on every login attempt, bypassing LOGIN_MAX_ATTEMPTS entirely. Fix: use ConnectInfo<SocketAddr> (via into_make_service_with_connect_info) as the primary rate-limit key; XFF is trusted only when the TCP peer is loopback (i.e. a local reverse proxy). Tests without a real socket fall back to XFF unchanged. Port configuration: NixOS module: split 'bind' string into separate 'listenAddress' (default 127.0.0.1) and 'port' (default 8080) options. openFirewall now uses cfg.port directly instead of parsing it from the bind string. README NixOS example updated accordingly.		2026-06-29 20:32:08 +02:00
..
archivr-server.nix	security: fix two Codex review findings + add port option	2026-06-29 20:32:08 +02:00